.

Author: connar

content/ctfwriteups/empirec2.md

@@ -7,3 +7,8 @@ categories = ["c2","Malware"]
 author = ["connar"]
 +++
 
+In this challenge we are given:
+<blockquote>
+    <p>A pcap file (capture.pcap)</p>
+    <p>A powershell dump (powershell.DMP)</p>
+</blockquote>

public/ctfwriteups/empirec2/index.html

@@ -7,7 +7,11 @@
 <meta name="robots" content="noindex, nofollow">
 <title>Empire C2 - Writeup | Journal of Connar</title>
 <meta name="keywords" content="empire c2">
-<meta name="description" content="Empire C2 - Writeup - Journal of Connar">
+<meta name="description" content="In this challenge we are given:
+
+    A pcap file (capture.pcap)
+    A powershell dump (powershell.DMP)
+">
 <meta name="author" content="connar">
 <link rel="canonical" href="http://localhost:1313/ctfwriteups/empirec2/">
 <link crossorigin="anonymous" href="/assets/css/stylesheet.1665878c578779cd11d4dc626b2c0e032a8b9c1dcf7d37f819200b4bc208b6a7.css" integrity="sha256-FmWHjFeHec0R1NxiaywOAyqLnB3PfTf4GSALS8IItqc=" rel="preload stylesheet" as="style">
@@ -149,11 +153,18 @@
     <h1 class="post-title entry-hint-parent">
       Empire C2 - Writeup
     </h1>
-    <div class="post-meta">0 min&nbsp;·&nbsp;connar
+    <div class="post-meta">1 min&nbsp;·&nbsp;connar
 
 </div>
   </header> 
 
+  <div class="post-content"><p>In this challenge we are given:</p>
+<blockquote>
+    <p>A pcap file (capture.pcap)</p>
+    <p>A powershell dump (powershell.DMP)</p>
+</blockquote>
+
+  </div>
 
   <footer class="post-footer">
     <ul class="post-tags">

public/ctfwriteups/index.html

@@ -199,7 +199,7 @@ <h2 class="entry-hint-parent">Chinese Windows Updater - Writeup
     <h2 class="entry-hint-parent">Empire C2 - Writeup
     </h2>
   </header>
-  <footer class="entry-footer">0 min&nbsp;·&nbsp;connar</footer>
+  <footer class="entry-footer">1 min&nbsp;·&nbsp;connar</footer>
   <a class="entry-link" aria-label="post link to Empire C2 - Writeup" href="http://localhost:1313/ctfwriteups/empirec2/"></a>
 </article>
 

public/ctfwriteups/index.xml

@@ -82,7 +82,11 @@ Of particular interest is the first post, which features a script that bears a s
       <link>http://localhost:1313/ctfwriteups/empirec2/</link>
       <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
       <guid>http://localhost:1313/ctfwriteups/empirec2/</guid>
-      <description></description>
+      <description>&lt;p&gt;In this challenge we are given:&lt;/p&gt;
+&lt;blockquote&gt;
+    &lt;p&gt;A pcap file (capture.pcap)&lt;/p&gt;
+    &lt;p&gt;A powershell dump (powershell.DMP)&lt;/p&gt;
+&lt;/blockquote&gt;</description>
     </item>
     <item>
       <title>Flag on the run - Writeup</title>